arthur-common (2.4.67), benchflow (>=0.6.1, <=0.6.5) +27 more potentially affected by CVE-2026-84377 via litellm (>=1.89.0, <=1.89.3)

litellm PYPI version =1.89.0, =0.6.1, =0.6.5 - cognee-community-graph-adapter-arcadedb 0.2.0 - cognee-community-graph-adapter-memgraph 0.2.0 - cognee-community-graph-adapter-networkx 1.1.0 - cognee-community-graph-adapter-pggraph 0.2.0 - cognee-community-graph-adapter-spanner 0.2.0 -...

0xpwn (0.1.1), a2a-acl (>=0.0.14, <=0.1.1) +825 more potentially affected by CVE-2026-84377 via litellm (>=1.0.0, <=1.88.1)

litellm PYPI version =1.0.0, =0.0.14, =0.0.14, =0.3.5, =0.7.3, =1.0.1, =1.0.2, =0.1.0, =0.4.0, =0.1.0, =0.1.39, =0.2.1, =0.2.1.10062025 - agent-memory-server 0.15.0 - agent-opt 0.0.1 and more Source cves: CVE-2026-84377 Source advisory: GHSA-3CV6-JPF6-8222...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +131 more potentially affected by CVE-2026-103241 via vllm (>=0.1.3, <=0.26.0)

vllm PYPI version =0.1.3, =0.2.1, =1.2.2, =2.3.5.dev0, =0.0.1b1, =0.2.2, =0.2.4, =0.1.0, =0.1.15rc1, =0.1.0, =0.1.0, =0.0.1, =0.0.38 and more Source cves: CVE-2026-103241 Source advisory: OSV:PYSEC-2026-4186...

aleph-alpha-inference (1.0.0), evoke-vllm (>=0.1.0, <=0.1.1) +7 more potentially affected by CVE-2026-103241 via vllm (>=0.22.0, <=0.29.0)

vllm PYPI version =0.22.0, =0.1.0, =2.8.0, =2.1.3, =0.1.10, =0.1.0, =0.1.4 Source cves: CVE-2026-103241 Source advisory: MEND:CVE-2026-103241...

360solutions-bc-mcp (>=0.5.3, <=0.5.7), adversarial-workflow (>=0.4.0, <=0.9.8) +558 more potentially affected by CVE-2026-97688 via urllib3 (>=2.6.2, <=2.7.0)

urllib3 PYPI version =2.6.2, =0.5.3, =0.4.0, =0.1.0, =0.5.0rc4, =0.1.0, =0.20.3, =0.0.2, =1.3.0, =0.1.0, =0.5.0, =1.1.0, =2.22.0 and more Source cves: CVE-2026-97688 Source advisory: GHSA-GH4C-6FX4-QH6G...

360solutions-bc-mcp (>=0.5.3, <=0.5.7), adversarial-workflow (>=0.4.0, <=0.9.8) +558 more potentially affected by CVE-2026-97688 via urllib3 (>=2.6.2, <=2.7.0)

urllib3 PYPI version =2.6.2, =0.5.3, =0.4.0, =0.1.0, =0.5.0rc4, =0.1.0, =0.20.3, =0.0.2, =1.3.0, =0.1.0, =0.5.0, =1.1.0, =2.22.0 and more Source cves: CVE-2026-97688 Source advisory: OSV:GHSA-GH4C-6FX4-QH6G...

SUSE CVE-2026-102904

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

0xdegenmo-lighter-mcp (0.1.1), 1337x (1.2.5) +14470 more potentially affected by CVE-2026-97689 via urllib3 (>=1.10.4, <=2.7.0)

urllib3 PYPI version =1.10.4, =0.3.0, =0.5.3, =0.0.1a0, =2.3.84, =0.1.0, =1.1.2, =0.1.0, =0.1.0, =0.0.2, =0.0.5, =0.0.7 - a-texam 1.1.0 and more Source cves: CVE-2026-97689 Source advisory: GHSA-VXQ7-64XX-V4GW...

0xdegenmo-lighter-mcp (0.1.1), 1337x (1.2.5) +11308 more potentially affected by CVE-2026-97687 via urllib3 (>=1.26.0, <=2.7.0)

urllib3 PYPI version =1.26.0, =0.3.0, =0.5.3, =0.0.1a0, =2.3.84, =0.1.0, =1.1.2, =0.1.0, =0.1.0, =0.0.5, =0.1.0, =0.8.2 and more Source cves: CVE-2026-97687 Source advisory: GHSA-8988-9CW3-XX77...

0xdegenmo-lighter-mcp (0.1.1), 1337x (1.2.5) +11308 more potentially affected by CVE-2026-97687 via urllib3 (>=1.26.0, <=2.7.0)

urllib3 PYPI version =1.26.0, =0.3.0, =0.5.3, =0.0.1a0, =2.3.84, =0.1.0, =1.1.2, =0.1.0, =0.1.0, =0.0.5, =0.1.0, =0.8.2 and more Source cves: CVE-2026-97687 Source advisory: OSV:GHSA-8988-9CW3-XX77...

aiohttp-ext-auth (>=0.1.1, <=0.1.2), ais-dom (>=0.76.5, <=0.91.5) +34 more potentially affected by CVE-2026-102270 via pyjwt (1.6.4)

pyjwt PYPI version 1.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aiohttp-ext-auth =0.1.1, =0.76.5, =0.0.1, =0.0.1, =0.4.0, =1.0.0, =0.0.19, =0.5.0, =1.1.7, =0.31.0, =0.0.1, =0.0.2, =0.1.0 and more Source cves:...

MAL-2026-17416 Malicious code in friendly-greeting-tools (PyPI)

Versions 0.1.0 through 0.3.6 of friendly-greeting-tools disguise encoded Snowflake credential and data theft routines as a hello-world demo. In versions through 0.3.5, the default rundemo payload reads the Snowflake session token, connection configuration, dbt profiles, and pip configuration, the...

Malicious code in friendly-greeting-tools (PyPI)

Versions 0.1.0 through 0.3.6 of friendly-greeting-tools disguise encoded Snowflake credential and data theft routines as a hello-world demo. In versions through 0.3.5, the default rundemo payload reads the Snowflake session token, connection configuration, dbt profiles, and pip configuration, the...

OESA-2026-4167 python-jupyterlab security update

JupyterLab is the next-generation user interface for Project Jupyter offering all the familiar building blocks of the classic Jupyter Notebook notebook, terminal, text editor, file browser, rich outputs, etc. in a flexible and powerful user interface. Security Fixes: JupyterLab versions...

Malicious code in beautifytext (PyPI)

beautifytext 1.0.3 imports beautifyText/compat.py from its init.py and from a setup.py install hook. That module starts a detached background process that registers the host hostname, user, OS, working directory with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read an...

MAL-2026-17417 Malicious code in beautifytext (PyPI)

beautifytext 1.0.3 imports beautifyText/compat.py from its init.py and from a setup.py install hook. That module starts a detached background process that registers the host hostname, user, OS, working directory with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read an...

MAL-2026-17325 Malicious code in cleanup-string (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844c5afa9f00c02149f4f6314447c5738e04ed419014809c1df83f31aa012525 The package advertises itself as a pure-Python string helper strip, slugify, case conversion, whitespace collapse and its README states the...

Malicious code in cleanup-string (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844c5afa9f00c02149f4f6314447c5738e04ed419014809c1df83f31aa012525 The package advertises itself as a pure-Python string helper strip, slugify, case conversion, whitespace collapse and its README states the...

MAL-2026-17319 Malicious code in bfox-build-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae53348f8261653938b39ae3cb79101baff666c4216ecaeb635e34b42ba8293 At install time, setup.py harvests the installer's GitHub credential and uses it to modify the installer's own repository. The script reads...

Malicious code in bfox-build-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae53348f8261653938b39ae3cb79101baff666c4216ecaeb635e34b42ba8293 At install time, setup.py harvests the installer's GitHub credential and uses it to modify the installer's own repository. The script reads...